In the Linux kernel, the following vulnerability has been resolved:

drm/xe: Fix null pointer dereference in devcoredump cleanup

In xe devcoredump snapshot free(), ss->gt may be NULL when the snapshot was never fully populated (e.g., when cleanup is triggered without a prior capture). Guard the xe guc capture put matched nodes() call with IS ERR OR NULL() to prevent a null dereference.

In xe devcoredump free(), the deferred work is only queued when a coredump is captured, so guard cancel work sync() with a check on coredump->captured.